Due to the increasing attainability of quantum computers, the threat to traditional cryptographic algorithms is more relevant than ever before. However, the field of Post-Quantum Cryptography (PQC) to address this is still young and may potentially exhibit security vulnerabilities. In this paper, the role of Pre-Shared Keys (PSK) is analyzed in an attack scenario with both traditional and post-quantum algorithms potentially broken. We present a scheme for improved integration of external PSKs into a PQC-secured TLS 1.3 handshake, with a focus on no security compromises and broad deployment options. In that context, the protection of long-term secrets on dedicated security tokens and the integration of Quantum Key Distribution (QKD) are elaborated. For QKD integration, our scheme enables a deployment without QKD-specific changes to TLS. In addition to the scheme itself, a reference implementation is presented and evaluated to demonstrate its technical viability. Our results indicate that the general integration of PSKs into the TLS handshake adds negligible overhead while substantially increasing the achieved security level. Although deployments using dedicated security tokens or QKD systems have a significant influence on handshake times, specific applications could benefit greatly from the added security guarantees.
Due to the increasing attainability of quantum computers, the threat to traditional cryptographic algorithms is more relevant than ever before. However, the field of Post-Quantum Cryptography (PQC) to address this is still young and may potentially exhibit security vulnerabilities. In this paper, the role of Pre-Shared Keys (PSK) is analyzed in an attack scenario with both traditional and post-quantum algorithms potentially broken. We present a scheme for improved integration of external PSKs into a PQC-secured TLS 1.3 handshake, with a focus on no security compromises and broad deployment options. In that context, the protection of long-term secrets on dedicated security tokens and the integration of Quantum Key Distribution (QKD) are elaborated. For QKD integration, our scheme enables a deployment without QKD-specific changes to TLS. In addition to the scheme itself, a reference implementation is presented and evaluated to demonstrate its technical viability. Our results indicate that the general integration of PSKs into the TLS handshake adds negligible overhead while substantially increasing the achieved security level. Although deployments using dedicated security tokens or QKD systems have a significant influence on handshake times, specific applications could benefit greatly from the added security guarantees.
With the advent of quantum computing, classical cryptographic techniques—such as those underpinning Transport Layer Security (TLS)—are becoming increasingly vulnerable. Although post-quantum cryptographic algorithms are being developed, their long-term security remains uncertain. Quantum Key Distribution (QKD) offers a fundamentally different approach to key exchange and secure communication, as it bases security on the physics of quantum information rather than computational difficulty. This paper presents a practical simulation framework that integrates QKD-derived keys into the TLS protocol using the Pre-Shared Key (PSK) mode. The system employs a layered QKD architecture, implemented using QuNetSim, to generate and manage quantum keys, which are then distributed through a centralized Key Management Server (KMS). The proposed approach demonstrates how quantum-generated keys can be seamlessly integrated into the TLS protocol to enhance resilience against quantum attacks, providing a viable pathway toward post-quantum-secure communication.
Large quantum computers will be able to break the cryptographic algorithms on which current secure communications rely on. Post-Quantum Cryptography (PQC) and Quantum key distribution (QKD) are two security technologies that show protection capabilities against the latent quantum threat. While PQC relies on different hard mathematical problems to develop a wide variety of cryptographic operations, QKD is based on quantum physics laws to generate and distribute symmetric cryptographic keys through different QKD protocols. These keys can be used by different applications to perform security transformations. QKD still requires authentication to prevent man-in-the-middle attacks. The hybridization of PQC and QKD is an important step for future secure infrastructures, being able to provide long-term security. In this work we propose authenticated QKD approaches that rely on pre-shared keys and hybrid PQC/QKD alternatives and which are able to securely exchange secret QKD keys through authenticated channels. We identify the different configuration alternatives and their parameters, as well as we develop a wide performance evaluation. Results show that pre-shared keys and PQC-based authentication through Dilithium algorithm are the fastest alternatives. Also, we show the potential of the T12 QKD protocol.
The emergence of large-scale quantum computers poses a significant threat to current cryptographic protocols, particularly Transport Layer Security (TLS), which relies on RSA and elliptic curve cryptography vulnerable to Shor's algorithm. This paper presents a hybrid framework for quantum-resistant TLS handshakes that integrates post-quantum cryptography (PQC), quantum key distribution (QKD) and classical cryptography to provide comprehensive protection against both classical and quantum attacks. The approach employs three QKD protocols; BB84, E91, and Measurement-Device-Independent QKD (MDI-QKD) alongside NIST-standardized PQC algorithms as well as alternative candidates such as HQC and BIKE. A key innovation is the QKD key management module, which addresses performance bottlenecks through periodic key generation and secure reuse within predefined retention periods, significantly reducing QKD overhead in TLS handshakes. The experimental implementation using the quantum network simulator evaluated 144 distinct cryptographic protocol combinations. Results demonstrate that ML-KEM combined with ML-DSA provides optimal PQC performance, while QKD protocol selection is distance-dependent: BB84 for short-range and MDI-QKD for long-distance communication. The framework includes various attack mitigation mechanisms and ensure security as long as at least one cryptographic method remains uncompromised. Consistent with current global quantum network usage, the proposed TLS approach is designed primarily for MAN and WAN environments rather than the Internet, providing a balanced solution that combines theoretical security guarantees with computational efficiency.
Post-quantum cryptography (PQC) and quantum key distribution (QKD) address the quantum threat from opposite directions: PQC replaces vulnerable public-key algorithms with schemes believed to resist quantum cryptanalysis, while QKD derives keys whose secrecy rests on physical assumptions rather than computational ones. Because each approach has a distinct failure mode, a growing body of work combines them so that a session key remains secure if either component holds. We first establish the deployed baseline, hybrid classical-plus-PQC key exchange, against which QKD-augmented designs must be judged. We then propose a taxonomy of hybrid PQC-QKD designs along eight dimensions (integration layer, combiner construction, authentication scope and source, QKD topology, trusted entities, key-delivery interface, classical component, and evidence type), and use it to compare published protocols, including Muckle and its successors, MACsec and TLS integrations, and IKEv2 mechanisms standardised in RFCs 8784, 9370, and 9867. We examine key-combiner constructions in light of the KEM-combiner literature and of NIST, ETSI, and ITU-T guidance, and map the security arguments for hybrid PQC-QKD protocols onto a common grid of security model, assumptions, permitted compromise, established guarantee, and limitations. We synthesise deployment evidence from metropolitan and national QKD networks, distinguishing the few testbeds that have run PQC in the key path from pure-QKD deployments, and summarise the standards and policy landscape, including the positions of national security agencies that recommend against relying on QKD alone. We close with open problems: authentication of the QKD classical channel, shared-infrastructure threat models, device certification versus formal proofs, formal verification of hybrid handshakes, and the lack of peer-reviewed deployment economics.
The potential of quantum computing to compromise traditional public-key cryptography (PKC) has led to a pressing need for more efficient and resilient cryptographic methods. Recent advancements, such as the 800x improvement in the logical error rate by Microsoft and QUANTINUUM, underscore the urgency of this issue. Post-quantum cryptography (PQC) offers a promising solution designed to withstand quantum attacks. This paper examines how PQC and other advanced cryptographic techniques can enhance the security and efficiency of PKC in the quantum era. Current PKC methods, despite revolutionizing secure online communication, are vulnerable to flaws in their underlying algorithms. The proposed hybrid model integrates PQC with traditional PKC, leveraging both technologies' strengths to mitigate quantum threats while preserving established security benefits. The investigation addresses critical research questions: how to enhance PKC key management for better efficiency and security, and which PQC techniques can protect PKC from quantum attacks. This paper's contribution includes identifying vulnerabilities in existing PKC, comparing RSA and post-quantum algorithms, and implementing a PQC algorithm between a client and server to analyze integration with existing protocols. Finally, the paper recommends security mechanisms to improve PQC protocols, ensuring robust protection against emerging quantum computing capabilities.
Shor's algorithm efficiently solves factoring and discrete logarithm problems using quantum computers, compromising all public key schemes used today. These schemes rely on assumptions on their computational complexity, which quantum computers can easily bypass. The solutions have to come from new algorithms - called Post-Quantum Cryptography (PQC) - or from new methods, such as Quantum Key Distribution (QKD). The former replicate the computational security ideas of classical public key algorithms, while the latter recurs to use the quantum properties of nature, which also brings a mathematical security proof, potentially offering Information-Theoretic Security. To secure data in the future, we must adopt these paradigms. With the speed of quantum computing advancements, the transition to quantum-safe cryptography within the next decade is critical. Delays could expose long-lived confidential data, as current encryption may be broken before its value expires. However, the shift must balance the adoption of new technologies with maintaining proven systems to protect against present and future threats. In this work, we have selected Transport Layer Security, one of the most widely used protocols, as the foundation to hybridize classical, quantum, and post-quantum cryptography in a way suitable for broad adoption in Software-Defined Networking, the most flexible networking paradigm that has been used to deploy integrated quantum-classical networks. To this end, we use standards for QKD key extraction and SDN integration. The purposed implementation is based on the latest version of TLS and demonstrates advanced capabilities such as rekeying and key transport across a large QKD network, while supporting crypto-agility and maintaining backward compatibility through the use of ciphersuites. The performance of this approach has been demonstrated using a deployed production infrastructure.